8268894: forged ASTs can provoke an AIOOBE at com.sun.tools.javac.jvm…

….ClassWriter::writePosition

Backport-of: a9188f237ec23d4ca2a172e9a7897cb6e2b69857

src/jdk.compiler/share/classes/com/sun/tools/javac/code/TypeAnnotationPosition.java

@@ -297,7 +297,6 @@ public boolean matchesPos(int pos) {
 
     public void updatePosOffset(int to) {
         offset = to;
-        lvarOffset = new int[]{to};
         isValidOffset = true;
     }
 

test/langtools/tools/javac/annotations/typeAnnotations/position/TypeAnnotationPositionProcessor.java

@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import com.sun.source.tree.MethodTree;
+import com.sun.source.tree.Tree;
+import com.sun.source.util.TreeScanner;
+import com.sun.source.util.Trees;
+import com.sun.tools.javac.tree.JCTree;
+import com.sun.tools.javac.tree.JCTree.*;
+
+import javax.annotation.processing.*;
+import javax.lang.model.SourceVersion;
+import javax.lang.model.element.Element;
+import javax.lang.model.element.ExecutableElement;
+import javax.lang.model.element.TypeElement;
+import javax.lang.model.util.ElementFilter;
+import java.util.Set;
+
+@SupportedAnnotationTypes("*")
+public class TypeAnnotationPositionProcessor extends AbstractProcessor {
+    private Trees trees;
+    private boolean processed = false;
+
+    @Override
+    public void init(ProcessingEnvironment pe) {
+        super.init(pe);
+        trees = Trees.instance(pe);
+    }
+
+    @Override
+    public boolean process(Set<? extends TypeElement> annotations, RoundEnvironment roundEnv) {
+        if (processed) {
+            return false;
+        } else {
+            processed = true;
+        }
+        Set<? extends Element> elements = roundEnv.getRootElements();
+        TypeElement typeElement = null;
+        for (TypeElement te : ElementFilter.typesIn(elements)) {
+            if ("TypeAnnotationPositionTest".equals(te.getSimpleName().toString())) {
+                typeElement = te;
+                break;
+            }
+        }
+        for (ExecutableElement m : ElementFilter.methodsIn(typeElement.getEnclosedElements())) {
+            if ("test".equals(m.getSimpleName().toString())) {
+                MethodTree methodTree = trees.getTree(m);
+                new PositionVisitor().scan(methodTree, ((JCMethodDecl) methodTree).pos);
+            }
+        }
+        return false;
+    }
+
+    private static class PositionVisitor extends TreeScanner<Void, Integer> {
+        @Override
+        public Void scan(Tree tree, Integer p) {
+            if (tree != null) ((JCTree) tree).pos = p;
+            return super.scan(tree, p);
+        }
+    }
+
+    @Override
+    public SourceVersion getSupportedSourceVersion() {
+        return SourceVersion.latest();
+    }
+}

test/langtools/tools/javac/annotations/typeAnnotations/position/TypeAnnotationPositionTest.java

@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8268894
+ * @summary Updating the type annotation position offset causes ArrayIndexOutOfBoundsException in ClassWriter
+ * @modules jdk.compiler/com.sun.tools.javac.tree
+ * @compile TypeAnnotationPositionProcessor.java
+ * @compile -processor TypeAnnotationPositionProcessor TypeAnnotationPositionTest.java
+ */
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Target;
+
+public class TypeAnnotationPositionTest {
+    TypeAnnotationPositionTest(char @MyTest [] bar) { }
+
+    @Target({ElementType.TYPE_USE})
+    @interface MyTest {
+    }
+
+    TypeAnnotationPositionTest test() {
+        char @MyTest [] val = new char[]{'1'};
+        return new TypeAnnotationPositionTest(val);
+    }
+}